<html>
<head><meta charset="utf-8"><title>integer-overflow · wg-secure-code · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/index.html">wg-secure-code</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html">integer-overflow</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="135943946"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135943946" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135943946">(Oct 17 2018 at 02:06)</a>:</h4>
<p>So to kick off some brainstorming... the combination of integer-overflows and unsafe code seems to be a relatively common source of vulnerabilities in unsafe code. This was the cause of the recent <code>str::repeat</code> issue, it was the cause of  the vulnerability in <code>base64</code>, and it's popped up a few times in some rust code review I've been doing.</p>
<p>It seems like there's two clear solutions: a) safe abstractions so that people don't have unsafe code, b) abstractions for allocation size computations so that  people aren't doing their own arithmetic. I imagine (a) will be a common theme as we figure out what all those patterns are. (b) is interesting. I wonder if there's any general solutions to the  integer-overflow + unsafe  code problem?</p>



<a name="135944004"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135944004" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135944004">(Oct 17 2018 at 02:08)</a>:</h4>
<p>(b) feels like there will be a (relative) explosion in use as more allocation-related pieces get closer to stabilization</p>



<a name="135944044"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135944044" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135944044">(Oct 17 2018 at 02:09)</a>:</h4>
<p>Could you provide a tiny concrete example of the problem? I'm only tangentially familiar with the details behind <code>str::repeat</code> and missed the base64 one.</p>



<a name="135944052"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135944052" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135944052">(Oct 17 2018 at 02:09)</a>:</h4>
<p><a href="https://doc.rust-lang.org/stable/std/alloc/struct.Layout.html" target="_blank" title="https://doc.rust-lang.org/stable/std/alloc/struct.Layout.html">https://doc.rust-lang.org/stable/std/alloc/struct.Layout.html</a> does exist, but it's difficult to imagine people use this for things like "compute <code>Vec</code> length", where a simple multiplication is a lot shorter</p>



<a name="135944142"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135944142" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Zach Reizner <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135944142">(Oct 17 2018 at 02:11)</a>:</h4>
<p>The integer overflow issue is what got me involved.</p>



<a name="135944147"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135944147" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135944147">(Oct 17 2018 at 02:11)</a>:</h4>
<p>Sure, the basic problem is that <code>str::repeat</code> did <code>let mut new_data = vec![self.len() * n; 0]</code> and then wrote to <code>new_data</code> using <code>unsafe</code>. If <code>self.len() * n</code> overflows you allocate a smaller space than expected, and your writes go off the end of the array.</p>



<a name="135944194"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135944194" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135944194">(Oct 17 2018 at 02:12)</a>:</h4>
<p><a href="https://github.com/rust-lang/rust/pull/54399/files#diff-773807740b9d7f176c85b4e2e34b2607L420" target="_blank" title="https://github.com/rust-lang/rust/pull/54399/files#diff-773807740b9d7f176c85b4e2e34b2607L420">https://github.com/rust-lang/rust/pull/54399/files#diff-773807740b9d7f176c85b4e2e34b2607L420</a></p>



<a name="135944197"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135944197" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Zach Reizner <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135944197">(Oct 17 2018 at 02:12)</a>:</h4>
<p>Our particular problem is that we need to allocate and fill structures that interface with the kernel. These structures tend to end with an unsized array.</p>



<a name="135944224"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135944224" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135944224">(Oct 17 2018 at 02:14)</a>:</h4>
<p>varsize structs seems like they should just have a safe allocation API. They're generated by bindgen right?</p>



<a name="135944262"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135944262" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135944262">(Oct 17 2018 at 02:14)</a>:</h4>
<p>I'll throw the strawman proposal  (c) out there: <em>always</em> enable overflow checks.</p>



<a name="135944271"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135944271" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Zach Reizner <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135944271">(Oct 17 2018 at 02:14)</a>:</h4>
<p><a href="https://elixir.bootlin.com/linux/latest/source/arch/x86/include/uapi/asm/kvm.h#L182" target="_blank" title="https://elixir.bootlin.com/linux/latest/source/arch/x86/include/uapi/asm/kvm.h#L182">https://elixir.bootlin.com/linux/latest/source/arch/x86/include/uapi/asm/kvm.h#L182</a></p>



<a name="135944272"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135944272" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Zach Reizner <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135944272">(Oct 17 2018 at 02:14)</a>:</h4>
<p>^ As an example of one such structure</p>



<a name="135944280"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135944280" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Zach Reizner <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135944280">(Oct 17 2018 at 02:15)</a>:</h4>
<blockquote>
<p>I'll throw the strawman proposal  (c) out there: <em>always</em> enable overflow checks.</p>
</blockquote>
<p>That's what we're experimenting with now in crosvm at least.</p>



<a name="135944330"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135944330" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135944330">(Oct 17 2018 at 02:16)</a>:</h4>
<p>It seems unlikely that Rust will go that way until the cost is brought down, much as it'd totally solve this problem.</p>



<a name="135944339"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135944339" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135944339">(Oct 17 2018 at 02:16)</a>:</h4>
<p><span class="user-mention" data-user-id="132723">@Zach Reizner</span> you generate the rust versions of these with bindgen right?</p>



<a name="135944354"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135944354" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Zach Reizner <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135944354">(Oct 17 2018 at 02:17)</a>:</h4>
<p>That's right</p>



<a name="135944359"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135944359" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Zach Reizner <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135944359">(Oct 17 2018 at 02:17)</a>:</h4>
<p>(AFK now, getting pulled away)</p>



<a name="135944423"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135944423" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135944423">(Oct 17 2018 at 02:19)</a>:</h4>
<p>Hmm, does Rust even have native support for var-sized structs with inline arrays, or is bindgen doing some hack to represent them? This case feels like it deserves a safe-allocation API.</p>



<a name="135944455"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135944455" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Zach Reizner <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135944455">(Oct 17 2018 at 02:19)</a>:</h4>
<p>For crosvm, we check in generated bindgen code</p>



<a name="135944459"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135944459" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Zach Reizner <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135944459">(Oct 17 2018 at 02:20)</a>:</h4>
<p>So possibly we are using out of date bindings</p>



<a name="135944515"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135944515" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Zach Reizner <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135944515">(Oct 17 2018 at 02:20)</a>:</h4>
<p>But it uses a generated incomplete array type to do zero length types inline</p>



<a name="135944524"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135944524" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Zach Reizner <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135944524">(Oct 17 2018 at 02:20)</a>:</h4>
<p>It has no allocation API that I'm aware of.</p>



<a name="135944531"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135944531" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135944531">(Oct 17 2018 at 02:21)</a>:</h4>
<p>To spitball another idea: a clippy lint that detected unchecked arithmetic that flowed into an allocation API. That'd have caught <code>str::repeat</code>, not <code>base64</code> though (the allocation computation is in a separate function).</p>



<a name="135944537"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135944537" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135944537">(Oct 17 2018 at 02:21)</a>:</h4>
<p>Ok. Proposing an allocation API in bindgen seems like a good outcome.</p>



<a name="135944724"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135944724" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Zach Reizner <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135944724">(Oct 17 2018 at 02:25)</a>:</h4>
<p>That would help but it would not be sufficient for a safe API</p>



<a name="135944777"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135944777" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Zach Reizner <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135944777">(Oct 17 2018 at 02:26)</a>:</h4>
<p>You would have to make sure that the count field in the structure agrees with the allocation</p>



<a name="135944804"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135944804" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135944804">(Oct 17 2018 at 02:27)</a>:</h4>
<p>I'm not sure you can solve that part in a general-purpose way -- I don't think bindgen has any way of knowing which field is the length (if there is one!)</p>



<a name="135944870"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135944870" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Zach Reizner <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135944870">(Oct 17 2018 at 02:28)</a>:</h4>
<p>Maybe we could use some kind of annotation</p>



<a name="135945244"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135945244" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135945244">(Oct 17 2018 at 02:38)</a>:</h4>
<p>What about something akin to how <code>calloc</code> takes two arguments: one for element size and one for count? Then <em>that</em> math could always be checked.</p>



<a name="135973040"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135973040" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135973040">(Oct 17 2018 at 13:35)</a>:</h4>
<p>I've wished there was an <code>AbortOnOverflow</code> in the same way there's <code>Wrapping</code></p>



<a name="135973052"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135973052" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135973052">(Oct 17 2018 at 13:35)</a>:</h4>
<p>right now abort-on-overflow semantics are... not very ergonomic</p>



<a name="135973128"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135973128" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135973128">(Oct 17 2018 at 13:36)</a>:</h4>
<p>I intend on replacing these with a proper <code>Accumulator</code> type but... ick <a href="https://github.com/iqlusioninc/crates/blob/master/subtle-encoding/src/macros.rs" target="_blank" title="https://github.com/iqlusioninc/crates/blob/master/subtle-encoding/src/macros.rs">https://github.com/iqlusioninc/crates/blob/master/subtle-encoding/src/macros.rs</a></p>



<a name="135979503"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135979503" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135979503">(Oct 17 2018 at 15:24)</a>:</h4>
<p>incidentally, it has always been the <em>intention</em> that code can locally enable stricter overflow checks (e.g., libstd might do this) — I know that some of the layout code in FF does this — does that seem relevant?</p>



<a name="135979509"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135979509" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135979509">(Oct 17 2018 at 15:24)</a>:</h4>
<p>right now I think that is a bit difficult to do though</p>



<a name="135979520"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135979520" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135979520">(Oct 17 2018 at 15:25)</a>:</h4>
<p>or at least not as elegant as originally envisioned</p>



<a name="135986050"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135986050" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135986050">(Oct 17 2018 at 17:05)</a>:</h4>
<p>Is there some feature for this I don't know about?</p>



<a name="135986070"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135986070" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135986070">(Oct 17 2018 at 17:05)</a>:</h4>
<p><code>#[overflow(abort)]</code> or thereabouts would be great</p>



<a name="135986124"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135986124" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135986124">(Oct 17 2018 at 17:06)</a>:</h4>
<p>I basically want the debug overflow behavior in release builds</p>



<a name="135986132"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135986132" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135986132">(Oct 17 2018 at 17:06)</a>:</h4>
<p>If you want that, you can have it</p>



<a name="135986140"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135986140" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135986140">(Oct 17 2018 at 17:06)</a>:</h4>
<p>but... selectively</p>



<a name="135986153"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135986153" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135986153">(Oct 17 2018 at 17:06)</a>:</h4>
<p>I guess the stuff I expect to wrap is explicitly <code>Wrapping</code></p>



<a name="135986156"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135986156" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135986156">(Oct 17 2018 at 17:06)</a>:</h4>
<p>so if that still works, and I get debug overflow on release everywhere else, that'd be great</p>



<a name="135986157"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135986157" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135986157">(Oct 17 2018 at 17:06)</a>:</h4>
<p><a href="https://stackoverflow.com/questions/34054669/how-to-compile-and-run-an-optimized-rust-program-with-overflow-checking-enabled" target="_blank" title="https://stackoverflow.com/questions/34054669/how-to-compile-and-run-an-optimized-rust-program-with-overflow-checking-enabled">https://stackoverflow.com/questions/34054669/how-to-compile-and-run-an-optimized-rust-program-with-overflow-checking-enabled</a></p>



<a name="135986162"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135986162" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135986162">(Oct 17 2018 at 17:07)</a>:</h4>
<p>JIC you were not aware</p>



<a name="135986188"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135986188" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135986188">(Oct 17 2018 at 17:07)</a>:</h4>
<p>oof, well I use <code>debug_assertions</code> to gate other stuff I don't want in release builds</p>



<a name="135986257"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135986257" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135986257">(Oct 17 2018 at 17:08)</a>:</h4>
<p><code>#[overflow(abort)]</code> at <code>fn</code>-level granularity would be great</p>



<a name="135986268"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135986268" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135986268">(Oct 17 2018 at 17:08)</a>:</h4>
<p>Oh, let me update that answer; <code>-C overflow-checks</code> exists now</p>



<a name="135986289"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135986289" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135986289">(Oct 17 2018 at 17:09)</a>:</h4>
<p>I agree about the fn level, but probably need to decide how it affects called functions</p>



<a name="135988018"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/135988018" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#135988018">(Oct 17 2018 at 17:36)</a>:</h4>
<p>nice re: -C overflow-checks</p>



<a name="136001015"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136001015" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Zach Reizner <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136001015">(Oct 17 2018 at 21:09)</a>:</h4>
<p>An overflow attribute applied to modules or at fn-level would be nice. I've certainly had times where I wanted that.</p>



<a name="136001210"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136001210" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Zach Reizner <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136001210">(Oct 17 2018 at 21:12)</a>:</h4>
<p>I don't think it makes sense for it to effect called functions. Thinking inductively, if you're in a position where an overflow in your called functions can hurt you in this function, you're fixing the wrong function.</p>



<a name="136001237"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136001237" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Zach Reizner <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136001237">(Oct 17 2018 at 21:13)</a>:</h4>
<p>For example, I'm not concerned with functions like Vec::with_capacity overflowing because I trust them to check the input parameters</p>



<a name="136001351"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136001351" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Zach Reizner <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136001351">(Oct 17 2018 at 21:15)</a>:</h4>
<p>I think that that attribute can also be linted against with respect to unsafe code. That is, unsafe code that does not have overflow protection in some form (Wrapping, -C overflow checks, #[overflow(abort)]) should throw up a warning on arithmetic.</p>



<a name="136001487"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136001487" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Zach Reizner <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136001487">(Oct 17 2018 at 21:17)</a>:</h4>
<p>I was reluctant about adding -C overflow to crosvm this week because I was afraid of performance regressions, but I would have enabled it in a heartbeat on some of our scarier unsafe modules.</p>



<a name="136001497"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136001497" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Liebow-Feeser <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136001497">(Oct 17 2018 at 21:17)</a>:</h4>
<p>What about functions which operate on integers but also return them? E.g., as a silly stramwn, a <code>fn mul(a: usize, b: usize) -&gt; usize</code></p>



<a name="136001501"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136001501" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Liebow-Feeser <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136001501">(Oct 17 2018 at 21:17)</a>:</h4>
<p>The author of <code>mul</code> is probably OK with overflow, and so doesn't check for it</p>



<a name="136001542"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136001542" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Liebow-Feeser <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136001542">(Oct 17 2018 at 21:18)</a>:</h4>
<p>But the consumer probably doesn't want overflow.</p>



<a name="136001580"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136001580" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136001580">(Oct 17 2018 at 21:18)</a>:</h4>
<p>That's the exact pattern in base64. <code>compute_size</code> had the overflow, but the actual flow into <code>String::with_capacity()</code> was elsewhere.</p>



<a name="136001672"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136001672" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Liebow-Feeser <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136001672">(Oct 17 2018 at 21:20)</a>:</h4>
<p>What is <code>compute_size</code> supposed to do? Because I'd argue that, if it does what I expect based on the name, it'd make more sense for it to return <code>Option&lt;usize&gt;</code> and be responsible for checking overflow.</p>



<a name="136001701"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136001701" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136001701">(Oct 17 2018 at 21:20)</a>:</h4>
<p>That was the fix for the security issue, yes :-)</p>



<a name="136001706"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136001706" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Zach Reizner <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136001706">(Oct 17 2018 at 21:21)</a>:</h4>
<p>Could you link that overflow bug for base64 compute_size for reference?</p>



<a name="136001735"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136001735" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136001735">(Oct 17 2018 at 21:21)</a>:</h4>
<p><a href="https://github.com/alicemaz/rust-base64/commit/24ead980daf11ba563e4fb2516187a56a71ad319" target="_blank" title="https://github.com/alicemaz/rust-base64/commit/24ead980daf11ba563e4fb2516187a56a71ad319">https://github.com/alicemaz/rust-base64/commit/24ead980daf11ba563e4fb2516187a56a71ad319</a></p>



<a name="136001788"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136001788" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Zach Reizner <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136001788">(Oct 17 2018 at 21:22)</a>:</h4>
<p>Thanks</p>



<a name="136001920"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136001920" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Zach Reizner <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136001920">(Oct 17 2018 at 21:25)</a>:</h4>
<p>So it looks like the unsafe is in the same module as the integer overflow.</p>



<a name="136001986"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136001986" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Zach Reizner <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136001986">(Oct 17 2018 at 21:26)</a>:</h4>
<p>I think a lint or mod level #![overflow(abort)] would have caught that.</p>



<a name="136002002"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136002002" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Zach Reizner <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136002002">(Oct 17 2018 at 21:26)</a>:</h4>
<p>Or would have if that existed :P</p>



<a name="136002019"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136002019" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Liebow-Feeser <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136002019">(Oct 17 2018 at 21:26)</a>:</h4>
<p>It strikes me that there's a fundamental issue here, which is that <code>unsafe</code> code is not supposed to rely on safe code to be correct.</p>



<a name="136002049"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136002049" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Liebow-Feeser <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136002049">(Oct 17 2018 at 21:27)</a>:</h4>
<p>In this case, you're right that a mod level attribute would have done it, but what about <code>unsafe</code> code which uses another crate like the strawman <code>offset_utils</code>, which provides safe functions that do the math?</p>



<a name="136002209"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136002209" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Zach Reizner <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136002209">(Oct 17 2018 at 21:30)</a>:</h4>
<p>I don't have a great answer for that.</p>



<a name="136002233"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136002233" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136002233">(Oct 17 2018 at 21:31)</a>:</h4>
<p>Does cargo provide a way to set a compilation option for a specific dependency?</p>



<a name="136002247"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136002247" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Liebow-Feeser <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136002247">(Oct 17 2018 at 21:31)</a>:</h4>
<p>In fairness, that example demonstrates a broader issue: even if overflow is fixed, there's nothing to prevent that crate from providing non-overflowing but still wrong results that would still be just as bad for soundness.</p>



<a name="136002253"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136002253" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Zach Reizner <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136002253">(Oct 17 2018 at 21:31)</a>:</h4>
<p>My hot take is that we can't make it impossible to make unsafe code that will backfire, but it should at least be as obvious as possible.</p>



<a name="136002256"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136002256" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Liebow-Feeser <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136002256">(Oct 17 2018 at 21:31)</a>:</h4>
<p>That's a reasonable hot take.</p>



<a name="136002258"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136002258" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Liebow-Feeser <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136002258">(Oct 17 2018 at 21:31)</a>:</h4>
<p><span class="user-mention" data-user-id="130046">@Alex Gaynor</span> No, I don't think it does.</p>



<a name="136002262"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136002262" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Liebow-Feeser <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136002262">(Oct 17 2018 at 21:31)</a>:</h4>
<p>I suppose such crates could manually provide Cargo features to do the same, though.</p>



<a name="136002309"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136002309" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Zach Reizner <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136002309">(Oct 17 2018 at 21:32)</a>:</h4>
<p>What scared me was that I was pretty confident about the quality of our unsafe code, but there was the hidden Spectre of unchecked overflow</p>



<a name="136002323"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136002323" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136002323">(Oct 17 2018 at 21:32)</a>:</h4>
<p>Just filed <a href="https://github.com/rust-lang-nursery/rust-bindgen/issues/1423" target="_blank" title="https://github.com/rust-lang-nursery/rust-bindgen/issues/1423">https://github.com/rust-lang-nursery/rust-bindgen/issues/1423</a> to start the discussion on the bindgen side.</p>



<a name="136002342"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136002342" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Zach Reizner <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136002342">(Oct 17 2018 at 21:33)</a>:</h4>
<p>However, if someone tried to submit unsafe code that depended on a lot of outer module math, I'd ask them how confident they were in that outer module.</p>



<a name="136002417"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136002417" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Liebow-Feeser <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136002417">(Oct 17 2018 at 21:34)</a>:</h4>
<p>I wonder how reasonable it would be to advance a best practice of having <code>unsafe</code> code only rely on other code from the same crate or code from std/core?</p>



<a name="136002464"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136002464" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Zach Reizner <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136002464">(Oct 17 2018 at 21:35)</a>:</h4>
<p>I think that would make using FFI too hard.</p>



<a name="136002506"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136002506" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Liebow-Feeser <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136002506">(Oct 17 2018 at 21:35)</a>:</h4>
<p>Sorry, I should amend: <code>unsafe</code> code should only rely on code from other crates if that code is also <code>unsafe</code>, and thus the implementor has also opted in to reasoning about memory safety themselves.</p>



<a name="136002549"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136002549" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Liebow-Feeser <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136002549">(Oct 17 2018 at 21:36)</a>:</h4>
<p>Does that address the concern about FFI?</p>



<a name="136002605"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136002605" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Zach Reizner <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136002605">(Oct 17 2018 at 21:37)</a>:</h4>
<p>I think that idea is worth considering.</p>



<a name="136002633"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136002633" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Liebow-Feeser <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136002633">(Oct 17 2018 at 21:37)</a>:</h4>
<p>Although I suppose the counter-point is that we shouldn't be encouraging authors to write <code>unsafe</code> APIs.</p>



<a name="136002724"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136002724" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Liebow-Feeser <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136002724">(Oct 17 2018 at 21:39)</a>:</h4>
<p>E.g., I've been working recently on some utilities to add automatic allocation, freeing, and reference counting to C types. That has a partially-<code>unsafe</code> API for the bits that the FFI has to plug in, but it provides a safe API for most of its operations. In turn, I use it from <code>unsafe</code> code.</p>



<a name="136002728"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136002728" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Zach Reizner <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136002728">(Oct 17 2018 at 21:39)</a>:</h4>
<p>Is there any precedent for giving core/std extra levels of trust? That seems unfair to other high quality crates.</p>



<a name="136002740"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136002740" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Liebow-Feeser <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136002740">(Oct 17 2018 at 21:39)</a>:</h4>
<p>I guess not. That's a fair point about other high quality crates.</p>



<a name="136002829"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136002829" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Zach Reizner <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136002829">(Oct 17 2018 at 21:40)</a>:</h4>
<p>(not to tangent this stream too much, but was there an existing proposal to have a curated set of such high quality crates)</p>



<a name="136002859"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136002859" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Liebow-Feeser <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136002859">(Oct 17 2018 at 21:40)</a>:</h4>
<p>Yeah, I've got concerns about such an idea. I'm worried it'll stagnate the ecosystem too much.</p>



<a name="136002893"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136002893" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Zach Reizner <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136002893">(Oct 17 2018 at 21:41)</a>:</h4>
<p>I like the idea, but you bring up a very good point.</p>



<a name="136002961"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136002961" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Liebow-Feeser <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136002961">(Oct 17 2018 at 21:42)</a>:</h4>
<p>In general, I think we should prefer technical solutions over social ones if we can find them. Social solutions tend to have ramifications which are harder to predict and harder to control.</p>



<a name="136002973"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136002973" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Liebow-Feeser <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136002973">(Oct 17 2018 at 21:42)</a>:</h4>
<p>Plus, it's easier to reason about the extent to which technical solutions will solve the target problem.</p>



<a name="136002980"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136002980" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Zach Reizner <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136002980">(Oct 17 2018 at 21:42)</a>:</h4>
<p>And even applying the high quality label can be concerning. Zlib2's website is a gigantic list of CVEs, libssh2 had a pretty bad bug this week, and even libstd has it's growing collecting of CVEs</p>



<a name="136002993"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136002993" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136002993">(Oct 17 2018 at 21:43)</a>:</h4>
<blockquote>
<p>not to tangent this stream too much,</p>
</blockquote>
<p>Remember you can make new zulip threads very easy ;-)</p>



<a name="136002994"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136002994" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Liebow-Feeser <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136002994">(Oct 17 2018 at 21:43)</a>:</h4>
<p>Yeah, that's a good point.</p>



<a name="136003015"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136003015" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136003015">(Oct 17 2018 at 21:43)</a>:</h4>
<p>(libssh, not libssh2, I think?)</p>



<a name="136003066"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136003066" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Zach Reizner <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136003066">(Oct 17 2018 at 21:44)</a>:</h4>
<p>Sorry, you're correct.</p>



<a name="136003077"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136003077" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Zach Reizner <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136003077">(Oct 17 2018 at 21:44)</a>:</h4>
<p>(that was directed at Jake and Alex)</p>



<a name="136064209"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136064209" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136064209">(Oct 18 2018 at 19:00)</a>:</h4>
<blockquote>
<p>It strikes me that there's a fundamental issue here, which is that <code>unsafe</code> code is not supposed to rely on safe code to be correct.</p>
</blockquote>
<p>This is too strong. But it's true that the code which unsafe code <em>uses</em> is part of its TCB. But as an extreme example I think it's right and proper for unsafe code to rely on <code>Vec</code>.</p>



<a name="136064257"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136064257" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136064257">(Oct 18 2018 at 19:01)</a>:</h4>
<p>I would say something like "unsafe code should be clear about which other code it relies upon and what it requires of that code"</p>



<a name="136064267"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136064267" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Liebow-Feeser <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136064267">(Oct 18 2018 at 19:01)</a>:</h4>
<p>Right.</p>



<a name="136064397"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136064397" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Liebow-Feeser <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136064397">(Oct 18 2018 at 19:03)</a>:</h4>
<p>It's just made confusing by the fact that, e.g., the following is generally considered unsound because it doesn't compose well with the space of all safe code: <code>pub fn deref&lt;T&gt;(ptr: usize) -&gt; &amp;T { ... }</code></p>



<a name="136064400"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136064400" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Liebow-Feeser <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136064400">(Oct 18 2018 at 19:03)</a>:</h4>
<p>In other words, there's at least part of the API surface of unsafe code which is supposed to be robust against <em>arbitrary</em> safe code.</p>



<a name="136064454"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136064454" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Liebow-Feeser <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136064454">(Oct 18 2018 at 19:04)</a>:</h4>
<p>It's probably worth trying to make that explicit - which parts need to be robust against arbitrary safe code, and which parts are allowed to call the safe code part of the TCB?</p>



<a name="136067962"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136067962" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136067962">(Oct 18 2018 at 20:04)</a>:</h4>
<blockquote>
<p><code>#[overflow(abort)]</code> at <code>fn</code>-level granularity would be great</p>
</blockquote>
<p><a href="https://github.com/llogiq/overflower" target="_blank" title="https://github.com/llogiq/overflower">https://github.com/llogiq/overflower</a> does pretty much this</p>



<a name="136068735"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136068735" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136068735">(Oct 18 2018 at 20:17)</a>:</h4>
<p>Looks like the bindgen folks are up for providing an allocation API for varsized structs: <a href="https://github.com/rust-lang-nursery/rust-bindgen/issues/1423" target="_blank" title="https://github.com/rust-lang-nursery/rust-bindgen/issues/1423">https://github.com/rust-lang-nursery/rust-bindgen/issues/1423</a> <span class="emoji emoji-1f389" title="tada">:tada:</span> If anyone wants to run with this, go for it, otherwise I'll probably pick it up in a week or two.</p>



<a name="136068838"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136068838" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Liebow-Feeser <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136068838">(Oct 18 2018 at 20:18)</a>:</h4>
<p><span class="user-mention" data-user-id="127617">@Shnatsel</span> That's really cool. I hadn't seen that before.</p>



<a name="136068861"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136068861" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136068861">(Oct 18 2018 at 20:18)</a>:</h4>
<p>Sadly it's nightly only and will probably stay that way. A.k.a. it's a no-go for actual production code.</p>



<a name="136069117"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136069117" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136069117">(Oct 18 2018 at 20:23)</a>:</h4>
<blockquote>
<p>And even applying the high quality label can be concerning. Zlib2's website is a gigantic list of CVEs, libssh2 had a pretty bad bug this week, and even libstd has it's growing collecting of CVEs</p>
</blockquote>
<p>I have been (tangentially) involved in both Rust libstd CVEs, and based on what I've seen, libstd is going to get a lot more CVEs as soon as someone decides to actually audit or fuzz it. It doesn't have more CVEs against it due to lack of auditing, not due to lack of vulnerabilities in it.</p>
<p>This led me to contemplate automatically generating fuzz harnesses for stateless stdlib functions. I've written <a href="https://gist.github.com/Shnatsel/4a907d44d6429de93d63d6e7c4d1361e" target="_blank" title="https://gist.github.com/Shnatsel/4a907d44d6429de93d63d6e7c4d1361e">a prototype</a> with just the vulnerable function where only 3 lines are function-specific, without any auto-generation for now, but it fails to discover the issue on my machine - probably because only one billionth of the 64-bit address space is actually sensible, everything else gets you an OOM crash. I need to try this in a 32-bit chroot, it will probably crash there, but I didn't get around to it. There is <a href="https://github.com/blt/bughunt-rust/commit/c34fe102718a072078a1467f2ed037cc358c4bd9" target="_blank" title="https://github.com/blt/bughunt-rust/commit/c34fe102718a072078a1467f2ed037cc358c4bd9">an alternative take</a> on the str::repeat fuzz harness, not sure if that detects the bug though.</p>
<p>Anyway, I will figure out the individual fuzz harness on my own. I could use some help with auto-generating code based on stdlib function definitions. The task is fairly trivial, but I've never used <code>syn</code> before, and didn't get a chance to spend some time figuring it out yet.</p>



<a name="136069332"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136069332" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Zach Reizner <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136069332">(Oct 18 2018 at 20:26)</a>:</h4>
<blockquote>
<p>Anyway, I will figure out the individual fuzz harness on my own. I could use some help with auto-generating code based on stdlib function definitions. The task is fairly trivial, but I've never used <code>syn</code> before, and didn't get a chance to spend some time figuring it out yet.</p>
</blockquote>
<p><code>syn</code> and <code>quote</code> are ok once you work an example or two.</p>



<a name="136069412"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136069412" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Zach Reizner <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136069412">(Oct 18 2018 at 20:28)</a>:</h4>
<blockquote>
<p>Looks like the bindgen folks are up for providing an allocation API for varsized structs: <a href="https://github.com/rust-lang-nursery/rust-bindgen/issues/1423" target="_blank" title="https://github.com/rust-lang-nursery/rust-bindgen/issues/1423">https://github.com/rust-lang-nursery/rust-bindgen/issues/1423</a> <span class="emoji emoji-1f389" title="tada">:tada:</span> If anyone wants to run with this, go for it, otherwise I'll probably pick it up in a week or two.</p>
</blockquote>
<p>That's great news. It looks like the author wants someone else to write it though.</p>



<a name="136069448"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136069448" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136069448">(Oct 18 2018 at 20:29)</a>:</h4>
<p>Yeah. I'll plan to get to it it, unless someone beats me to it.</p>



<a name="136079617"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136079617" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136079617">(Oct 18 2018 at 23:50)</a>:</h4>
<p><span class="user-mention" data-user-id="127617">@Shnatsel</span> neat</p>



<a name="136117652"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136117652" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136117652">(Oct 19 2018 at 15:12)</a>:</h4>
<p>heh, forgot about this re: <code>-C overflow-checks</code></p>



<a name="136117663"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136117663" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136117663">(Oct 19 2018 at 15:12)</a>:</h4>
<blockquote>
<p>warning: profiles for the non root package will be ignored, specify profiles at the workspace root:</p>
</blockquote>



<a name="136117688"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136117688" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136117688">(Oct 19 2018 at 15:13)</a>:</h4>
<p>overflower looks like it does what I want though</p>



<a name="136117705"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136117705" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136117705">(Oct 19 2018 at 15:13)</a>:</h4>
<p>oh wait, nightly-only</p>



<a name="136123979"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136123979" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Zach Reizner <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136123979">(Oct 19 2018 at 16:51)</a>:</h4>
<p>Could we do an RFC to include that functionality in the stable compiler?</p>



<a name="136124749"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136124749" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136124749">(Oct 19 2018 at 17:02)</a>:</h4>
<p>I would be a big fan of that</p>



<a name="136125461"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136125461" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136125461">(Oct 19 2018 at 17:12)</a>:</h4>
<p>SMACK can also be used for auditing code for integer overflows statically, so you don't have to inject runtime checks that degrade performance: <a href="http://soarlab.org/publications/atva2018-bhr.pdf" target="_blank" title="http://soarlab.org/publications/atva2018-bhr.pdf">http://soarlab.org/publications/atva2018-bhr.pdf</a></p>



<a name="136125617"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136125617" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136125617">(Oct 19 2018 at 17:14)</a>:</h4>
<p>It only works in reasonable time on standalone functions, not entire projects, but that's not really an issue since you usually want individual functions to be secure, not some functions behaving poorly but the rest of the code being structured in a way that masks that. That would be a pretty nasty non-local invariant.</p>



<a name="136125740"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/136125740" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#136125740">(Oct 19 2018 at 17:16)</a>:</h4>
<p><span class="user-mention" data-user-id="132723">@Zach Reizner</span> guess I'll make a topic for RFC ideas</p>



<a name="147931544"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/147931544" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#147931544">(Nov 18 2018 at 21:17)</a>:</h4>
<p>so, this change really is equivalent, right? /cc <span class="user-mention" data-user-id="116009">@nikomatsakis</span></p>



<a name="147931547"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/147931547" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#147931547">(Nov 18 2018 at 21:17)</a>:</h4>
<p>aside from the specifics of how I was aborting</p>



<a name="147931554"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/147931554" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#147931554">(Nov 18 2018 at 21:17)</a>:</h4>
<p>because if so that's pretty awesome</p>



<a name="147931555"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/147931555" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#147931555">(Nov 18 2018 at 21:17)</a>:</h4>
<p><a href="https://github.com/iqlusioninc/crates/pull/122/files" target="_blank" title="https://github.com/iqlusioninc/crates/pull/122/files">https://github.com/iqlusioninc/crates/pull/122/files</a></p>



<a name="147931602"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/147931602" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#147931602">(Nov 18 2018 at 21:18)</a>:</h4>
<p>particularly awesome in that it's a one-liner for an entire workspace</p>



<a name="147931662"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/147931662" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#147931662">(Nov 18 2018 at 21:20)</a>:</h4>
<p>it's also a little terrifying in that it's a single place someone could inadvertently shut it off for a whole workspace <span class="emoji emoji-1f62e" title="open mouth">:open_mouth:</span></p>



<a name="147931663"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/147931663" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#147931663">(Nov 18 2018 at 21:20)</a>:</h4>
<p>Write a test!</p>



<a name="147931670"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/147931670" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#147931670">(Nov 18 2018 at 21:21)</a>:</h4>
<p>I mean, how can I test it short of finding an integer overflow bug and exploiting it?</p>



<a name="147931672"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/147931672" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#147931672">(Nov 18 2018 at 21:21)</a>:</h4>
<p>I guess I could test in each crate that it's on at all</p>



<a name="147931682"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/147931682" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#147931682">(Nov 18 2018 at 21:21)</a>:</h4>
<p>I guess it'd need to be something in a release build</p>



<a name="147931728"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/147931728" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#147931728">(Nov 18 2018 at 21:22)</a>:</h4>
<p>Right, have a test that verifies that <code>usize::MAX + 1</code> panics.</p>



<a name="147931730"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/147931730" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#147931730">(Nov 18 2018 at 21:22)</a>:</h4>
<p>how would I test the release profile though?</p>



<a name="147931743"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/147931743" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#147931743">(Nov 18 2018 at 21:23)</a>:</h4>
<p>there's uhh... <code>#[lazy]</code> or whatever, but that seems like the wrong solution</p>



<a name="147931744"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/147931744" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#147931744">(Nov 18 2018 at 21:23)</a>:</h4>
<p>Oh hmm; does <code>cargo test</code> have a <code>--release</code> flag?</p>



<a name="147931748"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/147931748" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#147931748">(Nov 18 2018 at 21:23)</a>:</h4>
<p>not sure, never tried to run tests in release mode</p>



<a name="147952697"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/147952697" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#147952697">(Nov 19 2018 at 08:47)</a>:</h4>
<blockquote>
<p>Oh hmm; does <code>cargo test</code> have a <code>--release</code> flag?</p>
</blockquote>
<p>It does</p>



<a name="147990222"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/147990222" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#147990222">(Nov 19 2018 at 19:54)</a>:</h4>
<blockquote>
<p>so, this change really is equivalent, right? /cc <span class="user-mention" data-user-id="116009">@nikomatsakis</span></p>
</blockquote>
<p><span class="user-mention" data-user-id="132721">@Tony Arcieri</span> btw I am not sure which change you are referring to, or what it should be equivalent <em>to</em> -- but I am in favor of allowing people to enable overflow checks on stable even in release builds.</p>
<p>I'm less sure about them <em>disable</em> overflow checks in debug builds.</p>



<a name="147990397"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/147990397" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#147990397">(Nov 19 2018 at 19:56)</a>:</h4>
<p><span class="user-mention" data-user-id="127617">@Shnatsel</span> </p>
<blockquote>
<p>This led me to contemplate automatically generating fuzz harnesses for stateless stdlib functions. I</p>
</blockquote>
<p>that sounds great btw =)</p>



<a name="147991692"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/147991692" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#147991692">(Nov 19 2018 at 20:15)</a>:</h4>
<p><span class="user-mention" data-user-id="116009">@nikomatsakis</span> aah sorry, it was this PR <a href="https://github.com/iqlusioninc/crates/pull/122/files" target="_blank" title="https://github.com/iqlusioninc/crates/pull/122/files">https://github.com/iqlusioninc/crates/pull/122/files</a></p>



<a name="147991765"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/147991765" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#147991765">(Nov 19 2018 at 20:16)</a>:</h4>
<p>it replaces usage of explicit <code>checked_*</code> with a workspace-wide <code>[profile.release] overflow-checks = true</code></p>



<a name="147992356"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/147992356" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#147992356">(Nov 19 2018 at 20:24)</a>:</h4>
<p>ah, I see</p>



<a name="147992358"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/147992358" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#147992358">(Nov 19 2018 at 20:24)</a>:</h4>
<p>presumably you have panic=abort too</p>



<a name="147992406"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/147992406" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#147992406">(Nov 19 2018 at 20:25)</a>:</h4>
<p>sounds equiv, anyway</p>



<a name="147992741"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/147992741" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#147992741">(Nov 19 2018 at 20:30)</a>:</h4>
<p>I don't have <code>panic = abort</code> and I suppose that's notable.</p>



<a name="147992759"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/147992759" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#147992759">(Nov 19 2018 at 20:30)</a>:</h4>
<p>however the previous behavior was just a <code>panic</code>. an <code>abort()</code> would probably be preferred for the integer overflow cases</p>



<a name="147992804"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/147992804" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#147992804">(Nov 19 2018 at 20:31)</a>:</h4>
<p>the change just seemed like such an ergonomic improvement in the code I went through with it</p>



<a name="147992813"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/147992813" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#147992813">(Nov 19 2018 at 20:31)</a>:</h4>
<p>eliminating arithmetic macros with... normal arithmetic syntax</p>



<a name="147992916"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/147992916" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#147992916">(Nov 19 2018 at 20:32)</a>:</h4>
<blockquote>
<p>I don't have <code>panic = abort</code> and I suppose that's notable.</p>
</blockquote>
<p>well I just saw this comment</p>
<div class="codehilite"><pre><span></span># Enable integer overflow checks in release builds
# WARNING: DO NOT REMOVE THIS! We rely on this for abort-on-overflow semantics
# in the event of integer arithmetic bugs.
</pre></div>


<p>perhaps I took "abort" too literally, <span class="user-mention" data-user-id="132721">@Tony Arcieri</span></p>



<a name="147995282"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/147995282" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#147995282">(Nov 19 2018 at 21:06)</a>:</h4>
<p>I think ideally I'd abort instead of panic on overflow</p>



<a name="147995330"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/147995330" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#147995330">(Nov 19 2018 at 21:07)</a>:</h4>
<p>like if I could have an annotation that does exactly what I'd want, it'd probably be <code>#[overflow(abort)]</code> or thereabouts</p>



<a name="147997372"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/147997372" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#147997372">(Nov 19 2018 at 21:37)</a>:</h4>
<p>Why is integer overflow so special that it deserves an abort while other issues may panic? If anything, I'd make overflows panic and other issues about. Although a consistent policy sounds like the best option</p>



<a name="148001755"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148001755" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Liebow-Feeser <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148001755">(Nov 19 2018 at 22:47)</a>:</h4>
<p>Is overflow behavior configurable on a per-crate basis? I didn't realize that.</p>



<a name="148056201"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148056201" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148056201">(Nov 20 2018 at 18:02)</a>:</h4>
<p><span class="user-mention" data-user-id="132362">@Joshua Liebow-Feeser</span> per-workspace basis, but yes</p>



<a name="148056207"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148056207" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148056207">(Nov 20 2018 at 18:02)</a>:</h4>
<p>in my case I consider per-workspace an advantage</p>



<a name="148064094"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148064094" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Liebow-Feeser <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148064094">(Nov 20 2018 at 20:06)</a>:</h4>
<p>Ah, so I couldn't publish a crate on <a href="http://crates.io" target="_blank" title="http://crates.io">crates.io</a> with that configuration?</p>



<a name="148066969"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148066969" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148066969">(Nov 20 2018 at 20:49)</a>:</h4>
<p>you can</p>



<a name="148066971"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148066971" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148066971">(Nov 20 2018 at 20:49)</a>:</h4>
<p>it's not recommended</p>



<a name="148066979"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148066979" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148066979">(Nov 20 2018 at 20:49)</a>:</h4>
<p>er, not sure what exactly you are referring to actually</p>



<a name="148067006"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148067006" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148067006">(Nov 20 2018 at 20:50)</a>:</h4>
<p>the panic=abort vs panic=unwind setting is "global" -- you can force it one way or the other, but it means you won't be interoperable with crates that force the other way</p>



<a name="148067054"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148067054" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Liebow-Feeser <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148067054">(Nov 20 2018 at 20:50)</a>:</h4>
<p>I'm referring to putting the appropriate configuration in my crate's <code>Cargo.toml</code> before publishing, with the expectation that the compiler would emit overflow checks for all of the code in my crate.</p>



<a name="148067059"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148067059" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148067059">(Nov 20 2018 at 20:50)</a>:</h4>
<p>ok, you mean the overflow checks</p>



<a name="148067060"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148067060" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Liebow-Feeser <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148067060">(Nov 20 2018 at 20:50)</a>:</h4>
<p>yeah</p>



<a name="148067076"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148067076" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148067076">(Nov 20 2018 at 20:50)</a>:</h4>
<p>I'm actually .. not entirely sure how that works, but our <em>intention</em>  when discussing the overflow checks way back when was crates could opt in</p>



<a name="148067084"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148067084" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148067084">(Nov 20 2018 at 20:50)</a>:</h4>
<p>i.e., independently from one another</p>



<a name="148067089"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148067089" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148067089">(Nov 20 2018 at 20:50)</a>:</h4>
<p>but also that it could be forced on you</p>



<a name="148067101"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148067101" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Liebow-Feeser <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148067101">(Nov 20 2018 at 20:51)</a>:</h4>
<p>OK interesting.</p>



<a name="148067104"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148067104" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148067104">(Nov 20 2018 at 20:51)</a>:</h4>
<p>basically, I wanted to encourage people to think of overflow as a bug, even if it's too costly to check for it all the time</p>



<a name="148067108"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148067108" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Liebow-Feeser <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148067108">(Nov 20 2018 at 20:51)</a>:</h4>
<p>Right</p>



<a name="148067122"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148067122" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148067122">(Nov 20 2018 at 20:51)</a>:</h4>
<p>(and if you want wrapping, you should use the methods)</p>



<a name="148067130"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148067130" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Liebow-Feeser <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148067130">(Nov 20 2018 at 20:51)</a>:</h4>
<p>And I guess it's a pre-linking thing, even for <code>#[inline]</code> functions, so it's fine to be a per-crate option</p>



<a name="148067148"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148067148" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148067148">(Nov 20 2018 at 20:51)</a>:</h4>
<p>yeah, so, I remember that inlining was a tricky case</p>



<a name="148067213"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148067213" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148067213">(Nov 20 2018 at 20:52)</a>:</h4>
<p>(in particular, I think that libstd is always compiled release and hence without overflow checks, and we were inlining the MIR for <code>Add</code> impls and so forth, and it was therefore without checks, but I think we fixed that .. somehow)</p>



<a name="148067247"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148067247" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148067247">(Nov 20 2018 at 20:53)</a>:</h4>
<p><span class="user-mention" data-user-id="119009">@eddyb</span> would maybe remember</p>



<a name="148067251"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148067251" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148067251">(Nov 20 2018 at 20:53)</a>:</h4>
<p>Ah, <a href="https://github.com/rust-lang/rust/pull/33905" target="_blank" title="https://github.com/rust-lang/rust/pull/33905">https://github.com/rust-lang/rust/pull/33905</a></p>



<a name="148067254"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148067254" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148067254">(Nov 20 2018 at 20:53)</a>:</h4>
<p>anyway, not answering your question :) just reminiscing</p>



<a name="148067258"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148067258" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148067258">(Nov 20 2018 at 20:53)</a>:</h4>
<p>your question is sort of a cargo one and I don't really know</p>



<a name="148067262"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148067262" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148067262">(Nov 20 2018 at 20:53)</a>:</h4>
<p>but there should be <em>some</em> way</p>



<a name="148067264"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148067264" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148067264">(Nov 20 2018 at 20:53)</a>:</h4>
<p>if not, we should fix that</p>



<a name="148067271"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148067271" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148067271">(Nov 20 2018 at 20:53)</a>:</h4>
<p>(imo)</p>



<a name="148067305"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148067305" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148067305">(Nov 20 2018 at 20:54)</a>:</h4>
<p>I'd be ok with an attribute too in the crate, personally</p>



<a name="148067334"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148067334" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148067334">(Nov 20 2018 at 20:54)</a>:</h4>
<p><code>#![overflow_check(panic)]</code> or something</p>



<a name="148067340"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148067340" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Liebow-Feeser <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148067340">(Nov 20 2018 at 20:54)</a>:</h4>
<p>Ah, gotcha. Either would work.</p>



<a name="148067378"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148067378" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148067378">(Nov 20 2018 at 20:55)</a>:</h4>
<p>I just personally don't want people to be able to turn them off, because then the meaning of <code>a + b</code> is context dependent</p>



<a name="148067406"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148067406" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Liebow-Feeser <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148067406">(Nov 20 2018 at 20:55)</a>:</h4>
<p>Sure, but presumably if the release-mode default is not to check, then opting in can only make things more robust, not less?</p>



<a name="148289075"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148289075" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148289075">(Nov 24 2018 at 19:52)</a>:</h4>
<p>yeah the whole abort thing is a big red herring, sorry. and I should probably change my comment to reflect it's a panic but not an abort</p>



<a name="148289076"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148289076" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148289076">(Nov 24 2018 at 19:52)</a>:</h4>
<p>comment in my code above</p>



<a name="148289124"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148289124" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148289124">(Nov 24 2018 at 19:54)</a>:</h4>
<p>I'd have a weak preference for aborting instead of panicking, lest an attack figure out a way to leverage <code>catch_unwind</code> to avoid an exit and exploit the overflow, but I'll take a panic for now</p>



<a name="148289180"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148289180" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148289180">(Nov 24 2018 at 19:56)</a>:</h4>
<p>Is there any reason to think <code>panic</code> might be more severe than a DoS?</p>



<a name="148289353"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148289353" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148289353">(Nov 24 2018 at 20:03)</a>:</h4>
<p>yeah, depends on the circumstances, and the severity of failure to handle an integer overflow correctly</p>



<a name="148289356"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148289356" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148289356">(Nov 24 2018 at 20:03)</a>:</h4>
<p>a panic is probably sufficient for most</p>



<a name="148289421"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148289421" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148289421">(Nov 24 2018 at 20:05)</a>:</h4>
<p>aborting would be nice if the overflow could be used to say, corrupt memory or leak cryptographic key material</p>



<a name="148293066"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148293066" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148293066">(Nov 24 2018 at 22:09)</a>:</h4>
<p>Actually, panicking is less safe in an environment where you want to prevent arbitrary code execution because writing unsafe code that's panic-safe and fast at the same time is really, <em>really</em> hard. To wit: <a href="https://rustsec.org/advisories/RUSTSEC-2018-0003.html" target="_blank" title="https://rustsec.org/advisories/RUSTSEC-2018-0003.html">https://rustsec.org/advisories/RUSTSEC-2018-0003.html</a> - and that's code written by Servo developers, who know their stuff and many of whom have worked on Rust itself</p>



<a name="148293231"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148293231" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148293231">(Nov 24 2018 at 22:14)</a>:</h4>
<p>It was fixed by leaking memory on panic instead of performing a double free.</p>



<a name="148301416"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148301416" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148301416">(Nov 25 2018 at 03:20)</a>:</h4>
<p><span class="user-mention" data-user-id="132721">@Tony Arcieri</span> You probably do want to run your tests in release mode. If you have to choose one of release/debug I would choose  release.</p>



<a name="148302019"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148302019" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148302019">(Nov 25 2018 at 03:42)</a>:</h4>
<p><span class="user-mention" data-user-id="133214">@briansmith</span> as it were, my tests include <code>#[cfg(debug_assertions))]</code>-gated mocks which generate <code>compile_error!</code>s if they are compiled into release builds</p>



<a name="148302211"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148302211" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148302211">(Nov 25 2018 at 03:50)</a>:</h4>
<p>I would really really really like to keep those mocks out of production builds, so them's the breaks</p>



<a name="148303875"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148303875" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148303875">(Nov 25 2018 at 04:48)</a>:</h4>
<p>(mocks for HSMs)</p>



<a name="148329100"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/148329100" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#148329100">(Nov 25 2018 at 19:19)</a>:</h4>
<p><span class="user-mention" data-user-id="133214">@briansmith</span> well as it were I was just bitten by not running tests in release mode, and just changed the impacted repository to do so (or rather, there is an open PR)</p>



<a name="155318555"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/155318555" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#155318555">(Jan 17 2019 at 08:18)</a>:</h4>
<p>sorry to bring this up again, but I just want to double/triple check here</p>



<a name="155318557"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/155318557" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#155318557">(Jan 17 2019 at 08:18)</a>:</h4>
<p>setting the following on a workspace's <code>Cargo.toml</code>:</p>



<a name="155318559"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/155318559" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#155318559">(Jan 17 2019 at 08:18)</a>:</h4>
<div class="codehilite"><pre><span></span>[profile.release]
overflow-checks = true
</pre></div>



<a name="155318562"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/155318562" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#155318562">(Jan 17 2019 at 08:18)</a>:</h4>
<p>that only applies to crates in that workspace, correct?</p>



<a name="155318576"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/155318576" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#155318576">(Jan 17 2019 at 08:19)</a>:</h4>
<p>i.e. does it or does it not enable those checks on transitive dependencies?</p>



<a name="155336645"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/155336645" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#155336645">(Jan 17 2019 at 14:00)</a>:</h4>
<p>I'm actually not sure about that</p>



<a name="155336667"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/155336667" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#155336667">(Jan 17 2019 at 14:00)</a>:</h4>
<p><span class="user-mention" data-user-id="116015">@Alex Crichton</span> would likely know, or maybe <span class="user-mention" data-user-id="116122">@simulacrum</span></p>



<a name="155336675"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/155336675" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#155336675">(Jan 17 2019 at 14:00)</a>:</h4>
<p>and/or <span class="user-mention" data-user-id="121055">@Pietro Albini</span> =)</p>



<a name="155336677"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/155336677" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#155336677">(Jan 17 2019 at 14:00)</a>:</h4>
<p>/me tags everybody</p>



<a name="155336703"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/155336703" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Pietro Albini <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#155336703">(Jan 17 2019 at 14:01)</a>:</h4>
<p>let's also tag <span class="user-mention" data-user-id="125254">@kennytm</span>, just to get everyone in there :D</p>



<a name="155336747"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/155336747" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#155336747">(Jan 17 2019 at 14:01)</a>:</h4>
<p>or we could RTFM</p>



<a name="155336748"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/155336748" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#155336748">(Jan 17 2019 at 14:01)</a>:</h4>
<blockquote>
<p>Cargo supports custom configuration of how rustc is invoked through profiles at the top level. Any manifest may declare a profile, but only the top level package’s profiles are actually read. All dependencies’ profiles will be overridden. This is done so the top-level package has control over how its dependencies are compiled.</p>
</blockquote>



<a name="155336749"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/155336749" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Pietro Albini <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#155336749">(Jan 17 2019 at 14:01)</a>:</h4>
<p>dunno by the way</p>



<a name="155336755"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/155336755" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#155336755">(Jan 17 2019 at 14:01)</a>:</h4>
<p>from <a href="https://doc.rust-lang.org/cargo/reference/manifest.html" target="_blank" title="https://doc.rust-lang.org/cargo/reference/manifest.html">https://doc.rust-lang.org/cargo/reference/manifest.html</a></p>



<a name="155336763"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/155336763" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#155336763">(Jan 17 2019 at 14:01)</a>:</h4>
<p>suggests that it applies to <em>everything</em>, <span class="user-mention" data-user-id="132721">@Tony Arcieri</span></p>



<a name="155336815"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/155336815" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#155336815">(Jan 17 2019 at 14:02)</a>:</h4>
<p><span class="user-mention" data-user-id="121055">@Pietro Albini</span> sorry <span class="emoji emoji-1f60a" title="blush">:blush:</span> I somehow imagine you know everything about cargo after having done enough crater runs</p>



<a name="155336819"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/155336819" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#155336819">(Jan 17 2019 at 14:02)</a>:</h4>
<p>not sure why that would be</p>



<a name="155336830"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/155336830" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Pietro Albini <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#155336830">(Jan 17 2019 at 14:02)</a>:</h4>
<p>I mean, I learned a lot about cargo :P</p>



<a name="155336842"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/155336842" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Pietro Albini <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#155336842">(Jan 17 2019 at 14:02)</a>:</h4>
<p>but we just strip workspace configuration during crater runs, so <em>shrugs</em></p>



<a name="155336846"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/155336846" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#155336846">(Jan 17 2019 at 14:02)</a>:</h4>
<p>=)</p>



<a name="155341991"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/155341991" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#155341991">(Jan 17 2019 at 15:08)</a>:</h4>
<p>Yeah it should apply to all crates within the workspace (not sure if you've figured that out yet)</p>



<a name="155342002"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/155342002" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#155342002">(Jan 17 2019 at 15:08)</a>:</h4>
<p>er, all crates + dependencies</p>



<a name="155342025"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/155342025" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#155342025">(Jan 17 2019 at 15:09)</a>:</h4>
<p>Though I <em>believe</em> dependencies could override that, not sure</p>



<a name="155345961"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/155345961" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#155345961">(Jan 17 2019 at 15:54)</a>:</h4>
<p>I knew crates in the workspace... the dependencies are what I'm unclear on</p>



<a name="155356494"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/155356494" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#155356494">(Jan 17 2019 at 18:20)</a>:</h4>
<p>I'm sure overflow checks do not apply to the standard library. That's something to keep in mind.</p>



<a name="155356513"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/155356513" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#155356513">(Jan 17 2019 at 18:21)</a>:</h4>
<p>okay saw the docs now, hmm. that really implies I should really be using explicit checked I/O syntax everywhere in my crates and not depending on <code>overflow-checks = true</code></p>



<a name="155358521"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/155358521" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#155358521">(Jan 17 2019 at 18:49)</a>:</h4>
<p>Maybe you could expose that as a feature and make it default?<br>
Also, <a href="https://github.com/llogiq/overflower" target="_blank" title="https://github.com/llogiq/overflower">https://github.com/llogiq/overflower</a> would come in handy if it weren't nightly-only</p>



<a name="156329465"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/156329465" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nikomatsakis <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#156329465">(Jan 17 2019 at 23:37)</a>:</h4>
<p><span class="user-mention" data-user-id="132721">@Tony Arcieri</span> yeah it seems like there may be a missing knob here</p>



<a name="156329570"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/156329570" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#156329570">(Jan 17 2019 at 23:39)</a>:</h4>
<p><span class="user-mention" data-user-id="116009">@nikomatsakis</span> I was a bit weirded out by using the profile setting in the first place, because it seems non-explicit in the <em>code</em>, and I think this pushed me over again</p>



<a name="156329633"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/156329633" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#156329633">(Jan 17 2019 at 23:40)</a>:</h4>
<p><span class="user-mention" data-user-id="116009">@nikomatsakis</span> what I want now is this, but as a first-class language feature <a href="https://crates.io/crates/checked" target="_blank" title="https://crates.io/crates/checked">https://crates.io/crates/checked</a></p>



<a name="156329653"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/156329653" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#156329653">(Jan 17 2019 at 23:40)</a>:</h4>
<p>effectively the opposite of <code>Wrapping</code></p>



<a name="156329672"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/156329672" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#156329672">(Jan 17 2019 at 23:40)</a>:</h4>
<p>I'll probably start with the crate, but uhh</p>



<a name="156329697"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/156329697" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#156329697">(Jan 17 2019 at 23:41)</a>:</h4>
<p>I don't want to tell everyone doing cryptography in Rust to use this one crate and then that one crate becomes a single point of compromise for any cryptography in Rust. <span class="emoji emoji-1f631" title="scream">:scream:</span></p>



<a name="156330050"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/156330050" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#156330050">(Jan 17 2019 at 23:46)</a>:</h4>
<p>Has anyone done any tests to check if overflow behavior specified in Cargo in a dependency actually applies to that dependency if toplevel crate does not specify anything? If the toplevel binary crate does not force any specific behavior, keeping the library's behavior sounds reasonable, and if it's not done currently it can be introduced as a (hopefully) non-breaking change</p>



<a name="156330161"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/156330161" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#156330161">(Jan 17 2019 at 23:48)</a>:</h4>
<p>that's what we were just talking about. it is documented as parent crates overriding their dependencies</p>



<a name="156330178"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/156330178" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#156330178">(Jan 17 2019 at 23:48)</a>:</h4>
<p>but now I'm just terrified to do it implicitly</p>



<a name="156330193"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/156330193" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#156330193">(Jan 17 2019 at 23:48)</a>:</h4>
<p><code>Checked</code> gets you all of the ergonomics of doing it implicitly, except it's explicit and not controlled in a spooky-action-at-a-distance fashion by some knob located who knows where</p>



<a name="156330217"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/156330217" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#156330217">(Jan 17 2019 at 23:49)</a>:</h4>
<p>also having <code>Wrapping</code> be a first-class part of the language, but not <code>Checked</code>, feels... inconsistent</p>



<a name="156337355"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/156337355" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#156337355">(Jan 18 2019 at 01:46)</a>:</h4>
<p><span class="user-mention" data-user-id="132721">@Tony Arcieri</span> Adding <code>Checked</code>to the standard library seems like a reasonable task for this WG to take up.</p>



<a name="156337423"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/156337423" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#156337423">(Jan 18 2019 at 01:48)</a>:</h4>
<p>I also think we should be able to allow/deny/forbid the default unchecked arithmetic at granularity of our choosing.</p>



<a name="156346503"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/156346503" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#156346503">(Jan 18 2019 at 05:55)</a>:</h4>
<p>I agree! I might take a crack at writing up a pre-RFC post to rust-internals</p>



<a name="156346523"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/156346523" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#156346523">(Jan 18 2019 at 05:55)</a>:</h4>
<p>I remember several years ago finding <code>Wrapping</code> and being like "ok, great, now where's <code>Checked</code>?" (I was implementing something that happened to need them both)</p>



<a name="157656684"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/157656684" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#157656684">(Feb 06 2019 at 01:24)</a>:</h4>
<p>So, an interesting idea was suggested to me recently: enable overflow-check-and-panic on release builds for <code>usize</code> only. A huge percentage of exploitable integer overflow -&gt; heap buffer overflow will be with <code>usize</code> (citation needed, but both of the ones I just checked were <code>usize</code>). And since it's only a small fraction of overall arithmetic, it'll have a much lower performance penalty than doing _all_ arithmetic.</p>



<a name="157657058"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/157657058" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Zach Reizner <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#157657058">(Feb 06 2019 at 01:31)</a>:</h4>
<p>What about u32 * u32 as usize style code?</p>



<a name="157663523"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/157663523" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#157663523">(Feb 06 2019 at 04:08)</a>:</h4>
<p>as in <code>(u32 * u32) as usize</code>. It wouldn't get protection.</p>



<a name="157663534"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/157663534" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#157663534">(Feb 06 2019 at 04:08)</a>:</h4>
<p>The design criteria were a) minimize performance overhead, b) maximize protection, c) easy to reason about</p>



<a name="157706202"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/157706202" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#157706202">(Feb 06 2019 at 17:05)</a>:</h4>
<p><span class="user-mention" data-user-id="130046">@Alex Gaynor</span> I tried enabling it across the board in projects... the problem is you don't get fine-grained control right now</p>



<a name="157706263"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/157706263" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#157706263">(Feb 06 2019 at 17:06)</a>:</h4>
<p>e.g. if I do that to prevent overflow bugs in my app logic, it also applies to curve25519-dalek</p>



<a name="157706278"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/157706278" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#157706278">(Feb 06 2019 at 17:06)</a>:</h4>
<p>where they want the checks in debug builds, but not in release builds for performance reasons</p>



<a name="157732550"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/157732550" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#157732550">(Feb 06 2019 at 22:29)</a>:</h4>
<p>They should use <code>.wrapping_add()</code> then</p>



<a name="157734504"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/157734504" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#157734504">(Feb 06 2019 at 22:55)</a>:</h4>
<p>like I can ask HdV but I think they want the overflow checks during debug builds</p>



<a name="157734632"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/157734632" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#157734632">(Feb 06 2019 at 22:57)</a>:</h4>
<p>Hmm, there's not an actual explicit API for that, just the default-but-not-garaunteed behavior.</p>



<a name="157734654"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/157734654" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#157734654">(Feb 06 2019 at 22:57)</a>:</h4>
<p>yeah...</p>



<a name="157734726"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/157734726" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#157734726">(Feb 06 2019 at 22:58)</a>:</h4>
<p>that's why I'm... less excited</p>



<a name="157734735"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/157734735" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#157734735">(Feb 06 2019 at 22:58)</a>:</h4>
<p>about <code>overflow-checks = true</code> for release builds</p>



<a name="157734769"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/157734769" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#157734769">(Feb 06 2019 at 22:58)</a>:</h4>
<p>Does curve25519-dalek actually use <code>usize</code> for representing limbs?</p>



<a name="157735250"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/157735250" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#157735250">(Feb 06 2019 at 23:04)</a>:</h4>
<p>going to guess not ¯\_(ツ)_/¯</p>



<a name="157735297"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/157735297" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#157735297">(Feb 06 2019 at 23:05)</a>:</h4>
<p>So it's unimpacted by my proposal :-)</p>



<a name="157735357"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/157735357" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#157735357">(Feb 06 2019 at 23:06)</a>:</h4>
<p>probably!</p>



<a name="157736284"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/157736284" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#157736284">(Feb 06 2019 at 23:18)</a>:</h4>
<p>If no one wants to tell me this is a horrible idea, I guess I'll write up an RFC this weekend</p>



<a name="157736425"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/157736425" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#157736425">(Feb 06 2019 at 23:19)</a>:</h4>
<p>curve25519-dalek is probably a good acid test... maybe ask them if they foresee any slowdowns... but otherwise SGTM</p>



<a name="157736444"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/157736444" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#157736444">(Feb 06 2019 at 23:19)</a>:</h4>
<p><code>usize</code> in general seems like not the thing to use in performance-oriented code</p>



<a name="157736505"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/157736505" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#157736505">(Feb 06 2019 at 23:20)</a>:</h4>
<p>so hopefully no collateral damage</p>



<a name="157736542"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/157736542" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#157736542">(Feb 06 2019 at 23:20)</a>:</h4>
<p>I think <code>usize</code> is (or will be) 128-bit on <code>riscv64</code> targets <span aria-label="thinking" class="emoji emoji-1f914" role="img" title="thinking">:thinking:</span></p>



<a name="157801651"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/157801651" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#157801651">(Feb 07 2019 at 18:45)</a>:</h4>
<p>There was a bit of non-public discussion about it, and someone from the Midori team in Microsoft shared their experiences on this. In their experience overflow checks introduce negligible performance overhead across the board; very rarely you would need to explicitly opt out of them for performance.</p>



<a name="157801925"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/integer-overflow/near/157801925" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/integer-overflow.html#157801925">(Feb 07 2019 at 18:48)</a>:</h4>
<p>I think overflow checks for <code>usize</code> alone are actually a great idea. I would prefer to have a way to express "I want this optimized out in release mode, but overflow in here is still a bug" though, and check that in debug mode.</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>